Tag Archive for: Mirai

La Botnet Mirai IZ1H9 amplia il suo arsenale. 13 nuovi exploit per dispositivi IoT sono stati integrati

/in


La Botnet Mirai IZ1H9 amplia il suo arsenale. 13 nuovi exploit per dispositivi IoT sono stati integrati

Redazione RHC 12 Ottobre 2023 08:28

La botnet, che i ricercatori rintracciano con l’identificatore IZ1H9, ha recentemente acquisito tredici nuovi exploit per attaccare router Linux, nonché dispositivi di D-Link, Zyxel, TP-Link, TOTOLINK e altri produttori.

Questa variante di Mirai è stata scoperta per la prima volta nell’agosto 2018 ed è una delle più attive: sfrutta le vulnerabilità senza patch dei dispositivi IoT per infettarli e utilizzarli per lanciare attacchi DDoS.

Secondo gli esperti di Fortinet, il picco degli attacchi IZ1H9 si è verificato nella prima settimana di settembre, quando il numero di tentativi di hacking dei dispositivi vulnerabili ha raggiunto le decine di migliaia.

I ricercatori elencano che in totale la botnet IZ1H9 utilizza più di 30 exploit nei suoi attacchi per le seguenti vulnerabilità risalenti al 2013-2015:

  • D-Link : CVE-2015-1187, CVE-2016-20017, CVE-2020-25506, CVE-2021-45382;
  • Netis WF2419 — CVE-2019-19356;
  • Sunhillo SureLine (versioni fino a 8.7.0.1.1) — CVE-2021-36380;
  • Geutebruck — CVE-2021-33544, CVE-2021-33548, CVE-2021-33549, CVE-2021-33550, CVE-2021-33551, CVE-2021-33552, CVE-2021-33553, CVE-2021-33554;
  • Gestione dispositivi Yealink (DM) 3.6.0.20 — CVE-2021-27561, CVE-2021-27562
  • Zyxel EMG3525/VMG1312 (prima della versione 5.50) : nessun CVE, ma esiste una vulnerabilità nel componente /bin/zhttpd/ dei dispositivi Zyxel;
  • TP-Link Archer AX21 (AX1800) — CVE-2023-1389;
  • Punti di accesso wireless Korenix JetWave – CVE-2023-23295;
  • router TOTOLINK — CVE-2022-40475, CVE-2022-25080, CVE-2022-25079, CVE-2022-25081, CVE-2022-25082, CVE-2022-25078, CVE-2022-25084, CVE-2022-2507 7 , CVE-2022-25076, CVE-2022-38511, CVE-2022-25075, CVE-2022-25083;
  • Router Prolink PRC2402M – CVE non specificato relativo a /cgi-bin/login.cgi (il payload associato ad esso non funziona).

Una volta sfruttata una delle vulnerabilità elencate, sul dispositivo viene consegnato il payload IZ1H9, che contiene un comando per ottenere il loader di script della shell l.sh da un URL specifico. Una volta eseguito, questo script rimuove i log per nascondere attività dannose e quindi recupera…

Source…

Mirai Botnet operators are using TP-Link routers for DDoS attacks, says US government

/in


Why it matters: The US government’s Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog and warned that they are being actively exploited in the wild. One of those vulnerabilities affects the TP-Link Archer AX21 (AX1800) WiFi router, and is being exploited by operators of the Mirai malware botnet.

Alongside the TP-Link router exploit, the two other vulnerabilities placed on the CISA’s list include the Oracle WebLogic Server Unspecified Vulnerability tracked as CVE-2023-21839 and the Apache Log4j2 Deserialization of Untrusted Data Vulnerability, tracked as CVE-2021-45046. According to the agency, all three types of vulnerabilities are frequent attack vectors for cybercriminals and pose “significant threat” to users.

The TP-Link router exploit was first detected at the Pwn2Own Toronto hacking event last December, where two different teams were able to breach the device using the LAN and WAN interfaces. The issue was reported to TP-Link in January and the company released a patch for it last month.

In a statement addressing the issue, TP-Link said that it takes security vulnerabilities “very seriously” and works diligently to mitigate any flaw that could jeopardize the security and privacy of its customers. The company also urged all users of the AX21 router to download and install the update as soon as possible.

As per the National Vulnerability Database (NVD), TP-Link’s Archer AX21 Wi-Fi 6 routers with firmware versions prior to 1.1.4 Build 20230219 contained an unauthenticated command injection vulnerability which allowed surreptitious remote code execution, enabling hackers to take over the device and use it for distributed denial-of-service (DDoS) attacks against game servers.

However, despite the fix being available, Trend Micro’s Zero Day Initiative (ZDI) research group has found that cybercriminals are exploiting the vulnerability in the wild. As per the report, the attacks were first detected on April 11 in Eastern Europe, but have since spread worldwide.

Operators of the Mirai botnet are known for quickly exploiting vulnerabilities in IoT devices, so it’s not a major…

Source…

TP-Link router zero-day exploited by Mirai botnet

/in



Vulnerable TP-Link Archer AX21 routers have been targeted by the Mirai botnet malware to expand its network using the CVE-2023-1389 flaw, which was first identified in December, reports The Record, a …

Source…

Mirai Botnet Targeted Wynncraft Minecraft Server, Cloudflare Reports

/in


Performance and security company Cloudflare reported that it stopped a 2.5Tbps distributed denial-of-service (DDoS) attack in Q3 2022 launched by a Mirai botnet against Minecraft server Wynncraft.

The data comes from the company’s latest DDoS Threat Report, which includes insights and trends about the DDoS threat landscape in the third quarter of 2022.

“Multi-terabit strong DDoS attacks have become increasingly frequent. In Q3, Cloudflare automatically detected and mitigated multiple attacks that exceeded 1Tbps,” the company wrote in a blog post on Wednesday.

“The largest attack was a 2.5Tbps DDoS attack launched by a Mirai botnet variant, aimed at the Minecraft server, Wynncraft. This is the largest attack we’ve ever seen from the bitrate perspective.”

According to Cloudflare, the multi-vector attack consisted of UDP and TCP floods. Still, the Wynncraft server infrastructure held and “didn’t even notice the attack” since the security firm filtered it out for them.

“Even with the largest attacks […], the peak of the attacks were short-lived. The entire 2.5Tbps attack lasted about 2 minutes […]. This emphasizes the need for automated, always-on solutions. Security teams can’t respond quickly enough.”

More generally, however, Cloudflare said it noticed a 405% increase in Mirai DDoS attacks compared with the second quarter of 2022, alongside a general increment by other threat actors.

“Attacks may be initiated by humans, but they are executed by bots — and to play to win, you must fight bots with bots,” Cloudflare wrote.

“Detection and mitigation must be automated as much as possible because relying solely on humans puts defenders at a disadvantage.”

Among the most impactful DDoS attacks of the last few months worth mentioning are the August ones against Taiwanese Government sites, the ones targeting UK financial institutions in September and the KillNet ones disrupting the websites of several US airports earlier this month.

Source…